SAP security note 1746943, "Unauthorized Modification via BSP SAPSIGN", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
BSP SAPSIGN can be exploited by attackers to modify application content without authorization. This can lead to the theft of authentication information from legitimate users.
Solution
Apply the necessary correction as outlined in the SAP Note. Ensure that all output parameters are properly encoded to prevent XSS attacks.
Reason and prerequisites
Insufficient encoding of output parameters in BSP SAPSIGN pages leads to reflected XSS vulnerabilities.
An attacker can deface web content, steal session data, and impersonate users, including administrators. This compromise can result in full security breaches of the application.
References
- SAP Note 888889 – additional context on automatic checks for security notes using RSECNOTE
Affected components
- SAP_BASIS 620 – 640
- SAP_BASIS 700 – 702
- SAP_BASIS 710 – 730
- SAP_BASIS 731
Full note on SAP: SAP Support Launchpad note 1746943
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
